1type: leaky
2name: xs539/joplin-server-bf
3description: "Detect Joplin Server bruteforce"
4filter: "evt.Meta.log_type == 'joplin_server_failed_auth'"
5groupby: evt.Meta.source_ip
6leakspeed: 15m
7capacity: 3
8blackhole: 1m
9labels:
10 service: joplin
11 confidence: 3
12 spoofable: 0
13 classification:
14 - attack.T1110
15 label: "Joplin Bruteforce"
16 behavior: "http:bruteforce"
17 remediation: true
18---
19type: leaky
20name: xs539/joplin-server-bf_user-enum
21description: "Detect Joplin Server bruteforce"
22filter: "evt.Meta.log_type == 'joplin_server_failed_auth'"
23groupby: evt.Meta.source_ip
24distinct: evt.Meta.target_user
25leakspeed: 15m
26capacity: 3
27blackhole: 1m
28labels:
29 service: joplin
30 confidence: 3
31 spoofable: 0
32 classification:
33 - attack.T1589
34 label: "Joplin User Enumeration"
35 behavior: "http:bruteforce"
36 remediation: true
